EUVD-2026-37248Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged EBS account
-
DeliveryReach EAM web tier over HTTP
-
ExploitSend crafted Internal Operations request
-
ExecutionRetrieve EAM-accessible data
-
ImpactRepeat to cause partial DoS
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must hold a valid low-privileged Oracle E-Business Suite account (PR:L) and have HTTP/HTTPS reachability to the EBS web tier hosting the Enterprise Asset Management Internal Operations component, against EBS versions 12.2.3 through 12.2.15; no user interaction, no admin role, and no special non-default configuration is required beyond having EAM deployed. Limiting factors: exploitation is bounded to data and availability that EAM itself can reach (scope unchanged, no integrity impact, only partial DoS), and organisations whose EBS instance is not internet-exposed and which tightly control account provisioning materially reduce the realistic attacker population. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L describes a network-reachable, low-complexity attack requiring only a low-privileged EBS account and no user interaction, which is realistic for any organisation with self-service EBS users or contractors. Confidentiality impact is high (full read of EAM-accessible data) while availability is only partial and integrity is unaffected, so this is primarily a data-exposure risk with a secondary nuisance-DoS, not a foothold for full compromise. No EPSS, KEV, SSVC or POC data was supplied, so exploitation probability cannot be quantified - the absence of a CWE and of independent third-party references also means the analysis relies entirely on Oracle's own advisory text. Treat as a high-priority patch for any internet-exposed or large multi-tenant EBS deployment, but lower priority where EBS is strictly internal and EAM data is not sensitive. |
| Exploit ScenarioDerived | A contractor or junior maintenance user with a valid but low-privileged EBS account authenticates to the EBS web tier over HTTP/HTTPS and issues crafted requests to the EAM Internal Operations endpoints, retrieving the full set of EAM-accessible records (work orders, asset data, internal operations details) that their responsibility should not expose. The same attacker can repeat resource-intensive requests to cause partial denial of service of the EAM module, degrading maintenance operations for legitimate users. No public exploit identified at time of analysis, but Oracle's own "easily exploitable" wording suggests crafting the request is straightforward once an account is held. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Information disclosure and partial denial of service in Oracle E-Business Suite Enterprise Asset Management (versions 12.2.3 through 12.2.15) allows a low-privileged authenticated attacker with HTTP network access to read all data accessible to the Enterprise Asset Management module and degrade its availability. Oracle rates the issue 7.1 CVSS 3.1 and describes it as easily exploitable. No public exploit identified at time of analysis and the CVE is not currently listed in CISA KEV.
RemediationAI
Patch available per vendor advisory: apply the fixes bundled in the Oracle Critical Patch Update of June 2026 documented at https://www.oracle.com/security-alerts/cspujun2026.html, which covers EBS 12.2.3 through 12.2.15. Until the CPU can be applied, restrict network reachability of the EBS web tier so that only trusted internal users can hit EAM URLs (for example via reverse-proxy URL filtering or WAF rules blocking /OA_HTML/ EAM endpoints), tighten EBS responsibility assignments so that low-privileged accounts do not have EAM responsibilities, and increase monitoring of HTTP access logs for anomalous EAM requests; note that URL filtering can break legitimate maintenance workflows and removing EAM responsibilities will disable EAM functionality for affected users. Rotate or review credentials of any low-privileged accounts that could already have abused the flaw, since exploitation leaves no integrity trace.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle E-Business Suite is Oracle's flagship integrated ERP suite, and Enterprise Asset Management (EAM) is the module covering asset lifecycle, work orders, preventive maintenance and Internal Operations. The flaw sits in the Internal Operations component of EAM and is reachable over HTTP via the standard EBS web tier, which fronts Oracle Application Server / WebLogic and the underlying Oracle Database. No CWE was assigned by Oracle in the advisory, but the impact profile (C:H/I:N/A:L) is consistent with an authorization or access-control gap that exposes EAM-scoped data and allows partial resource exhaustion rather than a memory-corruption or injection bug. The single CPE provided (cpe:2.3:a:oracle_corporation:oracle_enterprise_asset_management) confirms the EAM module is the affected asset class.
Know when Oracle Enterprise Asset Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Network-reachable EBS web tier (AV:N), Oracle calls it easily exploitable (AC:L), requires a low-privileged EBS account (PR:L), no user interaction, high confidentiality and only partial availability impact with no integrity change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Asset Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Enterprise Asset Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Enterprise Asset Management. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).
Executive ViewAI
Oracle E-Business Suite Enterprise Asset Management (versions 12.2.3-12.2.15) is vulnerable to unauthorized asset data disclosure and service disruption by low-privileged authenticated users. While no public exploit has been identified to date, the absence of a vendor patch creates urgent risk requiring immediate compensating controls. Organizations using this module face exposure to sensitive inventory data and operational disruption without remediation.
Restrict HTTP network access to EAM modules at firewall and proxy layer, limiting access to authorized users and systems only. Enforce restrictive role-based access controls minimizing permissions granted to low-privileged user accounts. Implement comprehensive audit logging of EAM module access, data queries, and export functions. Monitor access logs for abnormal patterns or unauthorized data retrieval attempts. Conduct periodic reviews of user role assignments to ensure alignment with least-privilege principle.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
GitHub PoC
Exploit-DB